Personal data

A law has been adopted prohibiting advertising from being placed on foreign agents’ resources On 28 February 2024 the State Duma adopted in the third reading Draft Law No. 553750-8, which provides for a prohibition on advertising being placed on foreign agents’ resources, and on advertising of foreign agents’ resources being placed in the Russian media.

A Law has been passed to increase fines threefold or more for the lack of a personal data subject's written consent

On 5 December 2023, the State Duma passed Draft Law No. 353266-8 “On amending the Russian Code of Administrative Offences”. The Law provides that fines will be increased for processing personal data without the subject's written consent in cases when such consent must be obtained. 

The list of grounds has been expanded for Roskomnadzor to conduct unscheduled audits of personal data operators On 18 November 2023, Order No. 720 of the Russian Ministry of Digital Development, Communications and the Mass Media dated 17 August 2023 came into effect which supplements the list of indicators of risks of mandatory requirements being violated while federal state control is being exercised over the processing of personal data.

The Russian Ministry of Justice has supported the concept of a draft law introducing new, and also increasing current, fines for non-compliance with requirements in the field of personal data protection

The Russian Ministry of Justice has drafted an official review of the Russian Government with respect to the draft of the federal law “On amending the Russian Code of Administrative Offences” submitted to the State Duma by Russian senators A.A. Turchak and I.V. Rukavishnikova, as well as deputy of the State Duma A.E. Hinshtein. The concept of the draft law has been supported, but there are a number of remarks on the amendments proposed.

A draft law is being prepared to introduce new and increasing current fines for non-compliance with requirements in the field of personal data protection

Senators Andrey Turchak and Irina Rukavishnikova, and deputy Alexander Hinstein have submitted a draft law to the Russian Government for review. The draft law proposes new administrative fines for operators failing to comply with the requirements of Federal Law No. 152-FZ “On personal data” dated 27 July 2006 (“152-FZ”). In addition, the draft law provides for an increase of current fines for non-compliance with the requirements for the processing of personal data.

A draft law has been submitted to The State Duma on increasing fines for a failure to obtain personal data subjects’ consents and on administrative liability for violations in the processing of biometric data

On 4 May 2023 Draft Law No. 353266-8 “On amending the Russian Code of Administrative Offences” was submitted to the State Duma. The Draft Law provides for a significant increase of fines for the processing of personal data without the data subject’s written consent in cases when such consent must be obtained under the law, as well as fines for the processing of biometric personal data in violation of statutory requirements.

New forms of notifications of Roskomnadzor have been approved Starting from 26 December 2022, personal data operators will be required to use new forms of notifications regarding the intention to process personal data, regarding changes in the information contained in the notification of the intention to process personal data, and regarding the termination of personal data processing.

Roskomnadzor has explained to operators the procedure for sending notifications about the processing of personal data and has published some forms of electronic notifications

Commonly abbreviated in Russian as “Roskomnadzor” or “RKN” has issued clarifications on the timeframes for operators to send notifications about the processing of personal data. The authority has also published electronic forms for operators to notify the fact of an illegal or accidental transfer of personal data that resulted in a violation of the rights of subjects, as well as the implementation of their cross-border transfer.

The Russian President has signed a law to increase the protection of rights of personal data subjects and toughen the requirements for operators of personal data Pepeliaev Group advises that on 14 July 2022 the Russian President signed the law providing for large-scale amendments to the Federal Law “On personal data”/

Administrative liability has been introduced for sellers (providers, or owners of aggregators) for groundlessly compelling consumers to provide personal data On 28 May 2022, the Russian President signed the Law on amending article 14.8 of the Russian Code of Administrative Offences[1] (the “Law”) in terms of additional measures of administrative liability being introduced for compelling consumers to provide personal data.

A prohibition has been introduced on the inclusion in the contract of conditions that infringe on the rights of consumers, and a prohibition on the unreasonable collection of a consumer's personal data On 1 May 2022, the President of the Russian Federation signed the Law amending article 16 of the Law of the Russian Federation "On the Protection of Consumers' Rights”.

A draft law has been submitted to the State Duma for the protection of personal data subjects to be enhanced On 6 April 2022, a draft law  was submitted to the State Duma providing for amendments to be introduced to Federal Law No. 152-FZ “On personal data” (the “Draft Law”). The draft law intends to enhance the protection of Russian citizens’ rights to the sanctity of their private life.